Deploy workforce/dev dataplane (Layer 2), mirroring the other domains

Real Konnect Control Plane 1dbd741c-0da2-4718-8c72-6f479530b371, PAT
in Vault. Replaces the TODO stubs with the proven three-file
pattern. JWT_AUDIENCE_WHITELIST includes mcp-workforce from the
start since Layer 3 was built the same session — see STATUS.md
section 23.

dev/api-gateway/gateway-kustomization.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: workforce-dev-api-gateway
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./dataplane-template
+  prune: true
+  postBuild:
+    substitute:
+      NAME: workforce-dev
+      NAMESPACE: workforce
+      CONTROL_PLANE_ID: "1dbd741c-0da2-4718-8c72-6f479530b371"
+      HOSTNAME: workforce-dev.sttlab.local
+    substituteFrom:
+      - kind: ConfigMap
+        name: dataplane-template-defaults